CVE catalog

CVE-2025-6275

wabt affected and fixed versions

[CVE catalog]

A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer because it might not affect "real world wasm programs". Therefore, this entry might get disputed as well in the future.

Severity
Low · CVSS 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.25% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence
Original provider fields
{
  "package_releases": [
    {
      "name": "wabt",
      "status": "vulnerable",
      "release": "sid",
      "version": "1.0.42+dfsg+~cs1.0.39-2"
    },
    {
      "name": "wabt",
      "status": "vulnerable",
      "release": "forky",
      "version": "1.0.42+dfsg+~cs1.0.39-2"
    },
    {
      "name": "wabt",
      "status": "vulnerable",
      "release": "trixie",
      "version": "1.0.36+dfsg+~cs1.0.36-2"
    },
    {
      "name": "wabt",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "1.0.32-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "wabt",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "wabt",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "wabt",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "wabt",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": ""
    }
  ],
  "distribution_packages": []
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [wabt]Unknown
    Details (2)

    • 1.0.32-1 · amd64 · bookworm

      Affected

      dsa · wabt · debian · bookworm; dsa · wabt · debian · 12

    • 1.0.32-1 · arm64 · bookworm

      Affected

      dsa · wabt · debian · bookworm; dsa · wabt · debian · 12

[Debian 13 (Trixie)]

  • [wabt]Unknown
    Details (2)

    • 1.0.36+dfsg+~cs1.0.36-2 · amd64 · trixie

      Affected

      dsa · wabt · debian · 13

    • 1.0.36+dfsg+~cs1.0.36-2 · arm64 · trixie

      Affected

      dsa · wabt · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]